ci: verify downstream fixtures use the release candidate

[codeforester]

Fixes #431. Moves fixtures to the 0.5 window, installs them without dependency resolution, verifies the installed distribution, and records actual-version evidence. Validation: validate_consumers and dashboard tests.

[codeforester]

Review: CI is red: ruff's import-sorting rule fails on scripts/record_compatibility_evidence.py. Split the import into from importlib.metadata import PackageNotFoundError and from importlib.metadata import version as distribution_version, or run ruff check --fix.

Otherwise the approach is sound: the downstream job installs extras first, so --no-deps still has click, typer and opentelemetry available, and the version assertion plus pip check close the silent-downgrade hole. Notes: (a) source_version is a new field on a schema_version: 1 record; confirm the dashboard/validator tolerate it and the docs describe it; (b) the fixtures now require base-cli>=0.5,<0.6, so they cannot be installed with dependency resolution until 0.5.0 is on PyPI. That is acceptable but worth stating in the compatibility README.